Red Hat Bugzilla – Bug 449742
Last modified: 2010-12-23 10:34:17 EST
Interpretation conflict in the Sun Java Virtual Machine (JVM) allows
user-assisted remote attackers to conduct a multi-pin DNS rebinding attack and
has an HTML document that references a "mayscript=true" Java applet through a
local relative URI, which may be associated with different IP addresses by the
browser and the JVM.
This is from http://crypto.stanford.edu/dns/dns-rebinding.pdf, the two other bugs from this paper that were also identified alongside this bug were CVE-2007-5273 and CVE-2007-5274.
We queried Sun in June 2008 whether this is a duplicate of CVE-2007-5273 or CVE-2007-5274 . But we never received an answer, and Sun never acknowledged this to be an genuine Java bug.
Given the age, the low impact, and the fact that the bug doesn't affect our shipped java versions (java-1.5.0-sun deprecated), I would opt to close this.